MCAI 2.0 Model Checking in Ten Minutes Edmund Clarke School of Computer Science Carnegie Mellon University

MCAI 2.0 Temporal Logic Model Checking  Model checking is an automatic verification technique for finite state concurrent systems.  Developed independently by Clarke and Emerson and by Queille and Sifakis in early 1980’s.  Specifications are written in propositional temporal logic. (Pnueli 77)  Verification procedure is an intelligent exhaustive search of the state space of the design.

MCAI 2.0 Model Checking The Model Checking Problem (Clarke and Emerson 81): Let M be a state-transition graph Let f be a formula of temporal logic a U bU e.g., a U b means “a holds true Until b becomes true” Does f hold along all paths that start at initial state of M ? Preprocessor Model Checker Representation of M Formula f True or Counterexample 3 aaaab

MCAI 2.0 Advantages of Model Checking  No proofs! (algorithmic not deductive)  Fast (compared to other rigorous methods)  No problem with partial specifications  Diagnostic counterexamples Safety Property: bad state unreachable Initial State 4

MCAI 2.0 Advantages of Model Checking  No proofs! (algorithmic not deductive)  Fast (compared to other rigorous methods)  No problem with partial specifications  Diagnostic counterexamples Safety Property: bad state unreachable Initial State Counterexample 5

MCAI 2.0 Many Industrial Successes 6  Try – / * –In 94’ Pentium, it doesn’t return 0, but 256.  Intel uses the SRT algorithm for floating point division. Five entries in the lookup table are missing.  Cost: $500 million  Xudong Zhao’s Thesis on Word Level Model Checking

MCAI 2.0 The State Explosion Problem System Description State Transition Graph Combinatorial explosion of system states renders explicit model construction infeasible. Combinatorial explosion of system states renders explicit model construction infeasible. Exponential Growth of … … global state space in number of concurrent components. … memory states in memory size. Exponential Growth of … … global state space in number of concurrent components. … memory states in memory size. Feasibility of model checking inherently tied to handling state explosion.

MCAI 2.0 CEGAR CounterExample-Guided Abstraction Refinement C Program InitialAbstraction Simulator No error or bug found Propertyholds Simulationsucessful Bug found Abstraction refinement Refinement Model CheckerVerification Spurious counterexample Counterexample Abstract Model

MCAI 2.0 Combating the State Explosion  Binary Decision Diagrams can be used to represent state transition systems more efficiently.  Symbolic Model Checking 1992  Semantic techniques for alleviating state explosion: –Partial Order Reduction. –Abstraction. –Compositional reasoning. –Symmetry. –Cone of influence reduction. –Semantic minimization.

MCAI 2.0 Model Checking since Clarke / Emerson: CTL Model Checking Sifakis / Quielle 1982EMC: Explicit Model Checker Clarke, Emerson, Sistla 1990Symbolic Model Checking Burch, Clarke, Dill, McMillan 1992SMV: Symbolic Model Verifier McMillan 1998 Bounded Model Checking using SAT Biere, Clarke, Zhu 2000Counterexample-guided Abstraction Refinement Clarke, Grumberg, Jha, Lu, Veith s: Formal Hardware Verification in Industry: Intel, IBM, Motorola, etc.

MCAI 2.0 Model Checking since Clarke / Emerson: CTL Model Checking Sifakis / Quielle 1982EMC: Explicit Model Checker Clarke, Emerson, Sistla 1990Symbolic Model Checking Burch, Clarke, Dill, McMillan 1992SMV: Symbolic Model Verifier McMillan 1998 Bounded Model Checking using SAT Biere, Clarke, Zhu 2000Counterexample-guided Abstraction Refinement Clarke, Grumberg, Jha, Lu, Veith CBMC MAGIC

MCAI 2.0 Grand Challenge: Model Check Software ! What makes Software Model Checking different ?

MCAI 2.0 What Makes Software Model Checking Different ?  Large/unbounded base types: int, float, string  User-defined types/classes  Pointers/aliasing + unbounded #’s of heap-allocated cells  Procedure calls/recursion/calls through pointers/dynamic method lookup/overloading  Concurrency + unbounded #’s of threads

MCAI 2.0 What Makes Software Model Checking Different ?  Templates/generics/include files  Interrupts/exceptions/callbacks  Use of secondary storage: files, databases  Absent source code for: libraries, system calls, mobile code  Esoteric features: continuations, self-modifying code  Size (e.g., MS Word = 1.4 MLOC)

MCAI 2.0 Software Example: Device Driver Code Also according to Wired News : “Microsoft has developed a tool called Static Device Verifier or SDV, that uses ‘Model Checking’ to analyze the source code for Windows drivers and see if the code that the programmer wrote matches a mathematical model of what a Windows device driver should do. If the driver doesn’t match the model, the SDV warns that the driver might contain a bug.”

MCAI Mars Polar Lander (1999) landing-logic error Spirit Mars Rover (2004) file-system error Aerospace Systems: Software Driven! Mission Loss 16 Airbus A380 Flight Deck Do you trust flight software?

MCAI 2.0  Scalability: each new Mars mission employs more software than all previous Mars missions together  Often no models, only code: software written in C, sometimes without the help of formal models  MCAI 2.0 can be used to extract abstract models from source code, analyze generated models, drive C-code testers, … 17 Embedded Systems Need MCAI